Audit Action# 102 Is Not Written To Aud$ If session Exceeds A Profile Limit (Doc ID 1372067.1)

Last updated on NOVEMBER 03, 2015

Applies to:

Oracle Database - Enterprise Edition - Version 11.2.0.2 and later
Information in this document applies to any platform.
Checked for relevance on 10-APR-2013

Symptoms

When AUDIT CREATE SESSION is in effect and even when the audit_trail parameter is set to "DB" or "DB,EXTENDED" it is observed that in some cases the audit record for the 'logoff by cleanup' event (action# 102) is written to an OS audit file.

The following is an example of how the audit records written to directory audit_file_dest look like:

$ egrep 102 *.aud
v1120_ora_25982_1.aud:SESSIONID:[8] "28041264" ENTRYID:[1] "1" USERID:[7]
"BLASTER" ACTION:[3] "102" RETURNCODE:[1] "0" LOGOFF$PREAD:[1] "4"
LOGOFF$LREAD:[4] "1174" LOGOFF$LWRITE:[1] "8" LOGOFF$DEAD:[1] "0" DBID:[9]
"450596567" SESSIONCPU:[2] "13"
v1120_ora_26592_1.aud:SESSIONID:[8] "28051273" ENTRYID:[1] "1" USERID:[7]
"BLASTER" ACTION:[3] "102" RETURNCODE:[1] "0" LOGOFF$PREAD:[1] "0"
LOGOFF$LREAD:[2] "37" LOGOFF$LWRITE:[1] "4" LOGOFF$DEAD:[1] "0" DBID:[9]
"450596567" SESSIONCPU:[2] "55"

Changes

A version or patch including the fix to unpublished bug 5476184 was installed.

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms